Search code examples
ruby-on-rails-3sanitizationaloha-editor

Prevent Rails from escaping saved html to database


I'm trying to save the following inside a textarea to one of my models:

<iframe width="560" height="315" src="http://www.youtube.com/watch?v=Ar7PxP76o28" frameborder="0" allowfullscreen></iframe>

However this is what it actually ends up saving:

&lt;iframe width=\"560\" \r\nheight=\"315\" src=\"http://www.youtube.com/watch?v=Ar7PxP76o28\" \r\nframeborder=\"0\" allowfullscreen&gt;&lt;/iframe&gt;

Is there any way I can prevent it from escaping the html? I'm trying to render a youtube embeded video inside of the show view using the following code:

= @foo.content.html_safe

However the html_safe helper doesn't seem to work if the html is escaped like this. I also tried swapping out html_safe with a raw wrapper but that didn't seem to work either.


Solution

  • As Zabba suggested there was actually a third-party involved that was causing this issue and not Rails itself. In my case I was using the Aloha WYSIWYG editor which was sanitizing any custom HTML that I added to my form without my permission.